Exchanges authorization code for access and refresh tokens, or refreshes tokens. This endpoint serves two purposes: 1) Authorization Code Grant - exchanges authorization code for tokens (supports both traditional flow with client_secret and PKCE flow with code_verifier), 2) Refresh Token Grant - exchanges refresh token for new access token.
Documentation Index
Fetch the complete documentation index at: https://finance.dev/llms.txt
Use this file to discover all available pages before exploring further.
OAuth2 grant type
authorization_code, refresh_token OAuth2 client identifier
Authorization code from /v1/oauth2/authorize/confirm (required for authorization_code grant)
Client secret (required for confidential clients and refresh_token grant)
PKCE code verifier (required for PKCE flow, replaces client_secret)
Redirect URI (required for authorization_code grant, must match authorization request)
Refresh token (required for refresh_token grant)
Tokens generated successfully
Bearer token for API authentication
Token type (always Bearer)
Bearer Access token expiration time in seconds (typically 3600 = 1 hour)
Token to refresh the access token
Refresh token expiration time in seconds (typically 2592000 = 30 days)
Space-separated list of granted scopes